If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

This simply isn't true. As Nihil noted, if it were true, disks would produce errors all the time, as they'd not be able to tell what data is current and which is old.

Among others: DBAN.

Well that is why there is a fat table this directs the computer where to see the data. So when people do quick formats all that is deleted is the fat table the data is still there but the directory isnt, until the data is completely written over it can still be seen. Im not an expert at hard drives but I do remember what I was taught back in my college days.

I also understand it that even after a full format the magnetic charge only formats to all zeros and if the magnetic charge isnt at full charge there would still be evedence of the ones, making it somewhat readable. True this may be very old information and hard drives have changed but I thought it was worth noting.

Well that is why there is a fat table this directs the computer where to see the data. So when people do quick formats all that is deleted is the fat table the data is still there but the directory isnt, until the data is completely written over it can still be seen. Im not an expert at hard drives but I do remember what I was taught back in my college days.

I also understand it that even after a full format the magnetic charge only formats to all zeros and if the magnetic charge isnt at full charge there would still be evedence of the ones, making it somewhat readable. True this may be very old information and hard drives have changed but I thought it was worth noting.

I think Nihil had it right: we crossed definitions of "deleted" with "overwriting". A quick format, indeed, leaves the data itself intact and it can be recovered. My apologies for jumping all over you about it.

I meant in terms of chronological order or "layers" on the platters. Not which data was "live" and which had been flagged as deleted Obviously, if the new data doesn't overwrite the old with a much stronger magnetic image the machine will have serious problems reading it.

Formatting is a different issue. It is true that a quick format will leave all the file contents on the drive. These could then be extracted with a data recovery program.

AFAIK, the "full format" is only available in Windows Vista, and will fill the drive with 0s. This would be virtually impossible to recover if the drive has been in use for some time as they would be overlaid over several previous "layers"

In other versions of Windows I believe that the only difference is that the regular format will also check the drive for bad sectors.

Incidentally, Encase is not a data recovery tool, it is an evidence gathering one. If you overwrite the drive thoroughly with even one pass, it is totally useless

in terms of being physically able to read the disk it IS very possible to read data that has been over written. The trouble is translating it back into data. Reading edges of tracks or particles that were "missed" in the overwrites is definitely possible. However, unless you started with a brand new drive in perfect condition, wrote some data to it then wrote over it with nothing but 0s the problem of extracting the actual data becomes completely impractical.

If the world doesn't stop annoying me I will name my kids ";DROP DATABASE;" and get revenge.

Yes, I believe that is what kythe told us. The proof of concept experiments were in a very controlled and artificial environment?

In the real World life is rather different. I am sure many can recall the incident a while back where the Alaska Department of Revenue "lost" the records pertaining to a $38 billion fund?

Their system was having problems due to corrupt data in the storage array and the perceived solution was to reformat and reload the data.

It would seem that this process included writing 0s to the drives, which makes sense, as that would remove the danger of an application subsequently reading the corrupt data and giving an error?

Unfortunately, the technician also formatted the backup drives as well

The data was irrecoverable, and the ADR had to spend some $250,000 in getting it re-entered manually.

This raises some additional questions IMO:

1. How would you reconstruct an overwritten striped RAID array?
2. How would you reconstruct overwritten compressed data?
3. How would you reconstruct overwritten encrypted data?
4. How would you determine and reconstruct different file types?......... for example, Alaska were using scanned PDF image files